Google Cloud Authentication Guide
Choose secure Google Cloud authentication and authorization for local, production, and cross-cloud workloads.
The document explicitly discourages long-lived service-account keys and recommends attached service accounts, short-lived credentials, impersonation, workload identity federation, API-key restrictions, and Secret Manager, with least-privilege guidance and partial data-flow disclosure. Points are deducted because user confirmation, rollback, credential-leak response, audit requirements, and complete sensitive-data boundaries are not specified.
The material is internally consistent and organized around human authentication, service-to-service authentication, authorization, examples, and a validation checklist, with several concrete commands and an ADC order. Points are deducted because the static files contain no test suite, CI coverage, compatibility matrix, or diagnosable abnormal-input error handling; reproducibility of key paths is therefore unproven.
Clarifying questions cover the identity, runtime environment, target API, and client-library context, and the skill addresses local development, production, GKE, Cloud Run, external clouds, and custom applications. Points are deducted because non-fit boundaries, an input/output contract, regional network reachability, and Chinese-language usage guidance are absent; the core function depends on Google Cloud services that may be difficult to reach from mainland China.
The name and description match the content, and the documentation has clear sections, examples, a checklist, references, repository installation guidance, an Apache-2.0 license, official organizational provenance, and an issue-reporting path. Points are deducted because the skill itself lacks a version, changelog, named maintenance owner, update policy, post-install dependency notes, and troubleshooting FAQs.
The skill provides directly usable guidance, commands, role examples, and deployment patterns for common Google Cloud authentication and authorization decisions, so it can complete the core advisory task. Points are deducted because nothing was executed, examples omit permission-grant commands, environment prerequisites, failure handling, and result confirmation, and users must still consult official documentation and supply concrete configuration.
The skill cites numerous Google official documents and states auditable details such as commands, roles, environments, and ADC lookup order; the repository also supplies a fixed revision, license, and official-source context. Points are deducted because there are no skill-level tests, CI results, third-party corroboration, or independent reproduction artifacts, so static review cannot justify more than 5 points.
- This is a static source review only; no commands, authentication flows, or examples were executed.
- Before implementation, confirm the project, principal, permission scope, and organizational policies, and verify that credentials are not written to logs or source control.
- The documentation does not address mainland-China reachability; some Google Cloud consoles and documentation may require additional network access conditions.
- The examples are advisory fragments rather than complete runnable configurations; add error handling, auditing, revocation, and recovery steps.
What does this skill do, and when should you use it?
This skill provides focused guidance for authenticating to and authorizing access to Google Cloud services and APIs. It covers human users, service accounts, Application Default Credentials, service account impersonation, workload identity federation, API keys, OIDC, and IAM. It asks about the principal, runtime environment, target resource, and client library before recommending an approach. It suits developers and administrators designing or troubleshooting Google Cloud access; the surrounding repository is installed with npx skills add google/skills and licensed under Apache-2.0.
Explains when to use gcloud auth login versus gcloud auth application-default login, and how to choose Google Cloud Console, ADC, service account impersonation, or attached service accounts; maps authentication approaches across local machines, Compute Engine, Cloud Run, GKE, AWS, Azure, and on-premises environments; explains IAM roles, API key restrictions, access scopes, short-lived tokens, OIDC ID tokens, and JWTs; provides human-to-service Python Storage, Cloud Run-to-Cloud SQL, and private Cloud Run OIDC examples; and applies a validation checklist for keys, default service accounts, cross-cloud access, and API key restrictions.
- A local developer needs a Python, Java, or other client library to access a Google Cloud API using ADC instead of manually managed credentials.
- An administrator needs to configure a least-privilege service account for production code running on Cloud Run or Compute Engine.
- A developer needs to access Google Cloud from AWS, Azure, or on-premises without using long-lived service account keys.
- A team needs GKE workloads to access selected Google Cloud APIs through Workload Identity Federation for GKE.
- A developer needs to call a private Cloud Run application and send a Google-signed OIDC ID token.
- An operator is troubleshooting an attached service account that has IAM permissions but cannot call an API and needs to check access scopes.
What are this skill's strengths and limitations?
- Covers local development, production services, GKE, external workloads, and custom applications.
- Clearly distinguishes CLI authentication from ADC, reducing a common local-development credential mistake.
- Strongly recommends attached service accounts, impersonation, and short-lived credentials over downloaded long-lived keys.
- Includes concrete IAM, API key restriction, and validation guidance.
- The repository is under active development and uses the Apache-2.0 license.
- It is instructional Markdown rather than an executable automation package, and no test suite is provided in the source.
- Apart from example gcloud commands, it does not provide complete client configuration, deployment manifests, or troubleshooting command sequences.
- Actual permissions, organization policies, and identity-provider configuration still require environment-specific decisions.
- The repository contains about 90 skills; this profile covers only the authentication skill and not sibling capabilities.
How do you install this skill?
Run npx skills add google/skills, then select the skill corresponding to skills/cloud/google-cloud-recipe-auth during the installation flow. The README does not document a client-specific directory for copying this skill manually.
How do you use this skill?
After installing it in an Agent Skills-compatible client, provide a concrete scenario such as: “My Python program runs locally and needs to read Cloud Storage; which authentication method should I use?” or “My Cloud Run service needs Cloud SQL access; how should I configure the service account and IAM?” The skill first asks clarifying questions about the principal, runtime, target, and client library, then recommends authentication and authorization steps. The source does not define a fixed trigger command or parameter format.
How does this skill compare with similar options?
Compared with using only gcloud auth login, this skill explains that CLI authentication is for gcloud management commands, while client libraries commonly use gcloud auth application-default login to configure ADC. Compared with downloading service account keys, it recommends impersonation, attached service accounts, or workload identity federation for short-lived credentials. Compared with relying solely on IAM, API keys can serve some public-data or simplified-access scenarios, but the skill says to restrict them to specific APIs and projects and store them in Secret Manager.